Poland

Bank Millennium S.A

78,000 €

GDPR enforcement action by Polish National Personal Data Protection Office (UODO) on 2021-10-14.

Rank · Sector

#102

of 322 in Finance, Insurance and Consulting

Rank · Poland

#20

of 110

Rank · All fines

#537

of 3,042

Case details

Authority: Polish National Personal Data Protection Office (UODO)
Date: 2021-10-14
Controller / Processor: Bank Millennium S.A
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 33 (1) GDPR, Art. 34 (1) GDPR
Type of violation: Insufficient fulfilment of data breach notification obligations

Summary

The Polish DPA (UODO) has imposed a fine of EUR 78,000 on Bank Millennium S.A..
The UODO had become aware of a data protection breach following a complaint against the bank. It turned out that correspondence sent by the bank through a courier service containing personal data such as first name, last name, PESEL number, home address, account numbers and identification numbers of customers, had been lost. In this regard, the UODO found that the bank had failed to report the incident to the DPA and provide adequate notice to the data subjects.

Open original source Links to the regulator's original publication or another source.